access rules changed in controllers to limit app to users login